1. WHO WE ARE

1.1. Definitions
“Affiliate” means, in relation to any entity, any other entity which directly or indirectly Controls, is Controlled by, or is under common Control with that first entity. “Control” for these purposes means the beneficial ownership of 50% or more of the issued share capital or the legal power to direct or cause the direction of the general management of the relevant entity.

“Allformance Group Entity” means any of the entities listed in Schedule 1, as such Schedule may be updated by the Agency from time to time by publication of an amended version of these GTC.

“Agreement” means the IO together with these GTC and any schedules or annexes referenced therein.

“Agency Products” mean any products to be delivered by the Agency as specified in the IO.

“Agency Services” mean any services to be delivered by the Agency as specified in the IO.
“Advance Support Services” have the meaning given to them in Section 6.3.

“Basic Support Services” have the meaning given to them in Section 6.1.

“Business Day” means a day other than a Saturday, Sunday or public holiday in the jurisdiction of the Agency and/or the Client when banks are open for business.

“Client Materials” mean all documents, information, items and materials in any form provided by the Client to the Agency, the Platform Owner and/or their Affiliates or Representatives.

“Confidential Information” has the meaning given in Section 11.

“Currency” means the lawful currency stated in the IO.

“Data Protection Legislation” means all applicable laws and regulatory requirements relating to the use of personal data and electronic communications privacy.

“Dispute” has the meaning given in Section 27.

“Effective Date” means the date of the IO stated in its heading.

“Fees” mean the fees for Agency Products and/or Agency Services as set out in the IO.

“Intellectual Property Rights” mean patents, rights to inventions, copyright and related rights, moral rights, trademarks, business names and domain names, goodwill and the right to sue for passing off or unfair competition, rights in designs, software, databases, know-how, trade secrets and all similar rights.

“Insertion Order” or “IO” means an insertion order mutually agreed by the Parties.

“Platform” means the web-based system for digital advertising campaign planning, management and optimization.

“Platform Owner” means the owner(s) of the Platform as agreed with the Client.

“Platform Agreement” means the agreement(s) between the Platform Owner (Google Ireland Limited) and the GMP-Authorised Agency in relation to Platform access and services, as in force from time to time.

“GMP-Authorised Agency” means any Allformance Group Entity that holds, at the relevant time, a valid Google Marketing Platform Sales Partner agreement (or equivalent reseller authorisation) with the Platform Owner.

“Non-GMP Agency Services” means Agency Services that do not involve the resale, sublicense, provisioning or fulfilment of Google Marketing Platform Products or Platform Services, including without limitation independent advisory, analytics, creative, and implementation services performed by the Agency using its own resources.

“Platform Products/Services” means the platforms and services specified in the IO.

“Report” has the meaning given in Section 10.1.

“Representatives” mean employees, officers, agents, consultants and advisers.

“Sales Partner Services” means Google Marketing Platform Advertising Services.

“Sanctions” have the meaning set out in the IO or as applicable under law.

“Sanctioned Party” means any person, entity, government or country that is the subject or target of any Sanctions, including any person, entity, government or country designated on any Sanctions list maintained by the United Nations, the European Union, the United Kingdom, the United States (including the U.S. Department of the Treasury’s Office of Foreign Assets Control “OFAC”), or any other applicable jurisdiction.

“Third Parties” means any third parties engaged by the Client or acting on behalf of or under contract with the Client, in connection with the performance of the Client’s obligations under these GTC or a respective IO.

“Client Data” means any data, content and information (including personal data) provided by, or on behalf of, the Client to the Agency and/or the Platform Owner in connection with the Agency Services, Agency Products, Platform Products and/or Sales Partner Services.

1.2. Construction rules: singular includes plural and vice versa; references to a gender include all genders; references to writing include email.

2. WHAT DATA WE COLLECT

We may collect the following categories of personal data:
- Contact data: Name, business email address, phone number, company name, role, and job title.
- Communication data: The content of business messages, emails, feedback, inquiries and related correspondence across the business communication channels described above, including relevant replies, available edits and forwarded text. This includes designated client chats, shared channels and collaboration spaces involving client representatives and other authorised participants. The Telegram chat-logging workflow does not download or retain attachments. Documents lawfully supplied through other approved service channels may be processed where relevant to the services.
- Website data: IP address, device type, browser type, operating system, language preferences, pages visited, time and date of visit, referring URL, session duration, and approximate location (country/city derived from IP address).
- Marketing data: Your preferences regarding marketing, records of consent, and your interaction with our communications (e.g., opens, clicks).
- Account data: Username and hashed/encrypted password if you create an account on our website.
- Communication identifiers and metadata: Names, business contact details, usernames and profile fields made available by the relevant service, together with relevant conversation, message and participant identifiers, dates, reply links and membership events. For Telegram,
this includes the user ID and display name; a phone number is collected only if shared or otherwise lawfully available, not automatically from an ordinary bot message.
- Client context and analytical records: Project requests, approvals, campaign preferences, action items, meeting transcripts and notes, and other derived records generated from business communications. These may relate to identifiable client representatives. Campaign performance statistics may also contain personal data where individuals can be identified. Information solely about a legal entity is not personal data merely because it concerns a client.
- Sources: We receive information directly from you and, where relevant, from your employer, colleagues, other participants, Telegram, Slack, email and other messaging or collaboration services used in our business activities and interactions with clients, as well as meetings, CRM and project-management systems and other corporate systems. Information may be received through the relevant service or retrieved through approved bots, connectors and integrations. Access is limited to designated business sources and the permissions necessary for the stated purposes; connecting an account does not authorise indiscriminate collection of its contents or employees’ private communications.

Meeting information: Where enabled, approved meeting assistants process meeting audio to generate transcripts, notes and action items. Audio processing and any temporary buffering are distinct from retaining an audio recording. We do not retain meeting audio recordings as part of our approved note-taking workflow. Any separate recording activity is disclosed in advance and requires its own lawful basis and any required consent.

- Sensitive Data: We do not seek sensitive personal data for chat archiving or general analytics. Please do not send health information, biometric identification data, criminal records, identification documents, payment card details or unrelated private information through routine client groups. If such information is received, we restrict access and assess whether a lawful and necessary reason for retaining it exists; otherwise we delete or redact it. We do not include such information in general AI-assisted analysis merely because it has been posted in a chat.

3. WHY WE USE YOUR DATA (LEGAL BASIS)

We use personal data only for the purposes and on a lawful basis permitted by the laws applicable to the particular processing. The lawful bases below are not interchangeable across jurisdictions; this Notice and a contract with your employer are not, by themselves, your consent to processing.

- To respond to you and manage our relationship: To answer your inquiries, provide information about our services, negotiate and execute contracts, and manage our business relationship.
Legal basis: Where the GDPR or UK GDPR applies, performance of a contract or pre-contractual steps applies only where you are personally a party to that contract or have requested those steps. For business contacts representing a corporate client, we may rely on legitimate interests in managing and documenting the business relationship, after assessing necessity and the impact on their rights. Where the UAE Federal Personal Data Protection Law applies, we rely on consent unless a specific exception under Article 4 applies, such as processing necessary for a contract with the individual, legal obligations or the exercise or defence of legal claims; we do not treat the GDPR legitimate-interests basis as a general exception under UAE law.

- To send you marketing communications: To send you relevant updates, newsletters, and other marketing materials.
Legal basis: Your consent where required by applicable law. Where the applicable law permits a legitimate-interests basis for direct B2B marketing, we rely on that basis only after assessing the relevant conditions and your rights. You can opt out at any time by clicking the "unsubscribe" link in our emails or contacting us.

- To improve and secure our website: To operate, secure, and improve our website and services. This includes analytics, error monitoring, security monitoring, and preventing fraud or abuse.
Legal basis: Consent where required for cookies or other processing; otherwise the applicable legal basis for necessary website operation and security, including legitimate interests where the applicable law permits that basis. A legitimate interest does not replace consent where consent is legally required.

- To comply with legal obligations: To comply with legal requirements (e.g., accounting, tax, regulatory reporting) and to protect our legal rights (e.g., responding to authorities, handling claims, dispute resolution).
Legal basis: Compliance with applicable legal obligations and, where applicable law permits, the establishment, exercise or defence of legal claims or legitimate interests in protecting our rights and preventing fraud.

- Business communications and client context: We may collect and keep records of designated business correspondence and meetings, retrieve instructions and prepare summaries, action items and other derived records. This covers Telegram, Slack, email and any other messaging services, collaboration platforms and approved connectors or integrations used in our business activities and interactions with clients, including connections to CRM, project-management and meeting systems. The Telegram workflow records messages and relevant metadata, not attachments. Access is limited to authorised personnel and providers who need the information. We provide the required information before activating collection, through the relevant channel, an account manager, email or another demonstrable means.

- Legal basis for business records and related analysis: Where the GDPR or UK GDPR applies, we may rely on assessed legitimate interests in continuity of client service, accurate records and proportionate internal analysis. Where consent is required by applicable law, including where no applicable UAE Article 4 exception is available, or by the relevant platform’s terms, we obtain it before the relevant processing. Remaining in a chat or meeting, signing a corporate contract or accepting website terms is not treated as an individual opt-in. You may contact us to discuss an alternative communication channel or meeting without the assistant.

- AI-assisted analysis: We use approved automated and AI-assisted tools to search client context, transcribe meetings, summarise communications, organise tasks and analyse campaign performance. This may involve processing relevant, minimised information through external providers, including commercial AI providers and meeting assistants where enabled. We remove unnecessary identifiers and restrict access to each client’s information. We do not permit providers to use identifiable or confidential client inputs or outputs to train their general-purpose models, or opt such information into training or feedback programmes. Provider-side model-improvement options are disabled where needed to meet these restrictions.

- Statistical improvement: Where the relevant client agreement and source-platform terms permit, we may create genuinely anonymous, aggregated campaign statistics for internal benchmarking, service improvement and development of internal analytical tools. Derived records are not treated as anonymous merely because names have been removed or information has been summarised. Messaging content and its derivatives are not used as a model-training dataset under this Notice. This Notice does not override applicable terms of messaging platforms, meeting assistants or other connected services.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

4. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies on our website to:
- Ensure essential functions work (strictly necessary cookies).
- Understand how visitors interact with our site (analytics cookies).
- Improve website performance and security.
- Remember your preferences (functional cookies).

Types of cookies we use:
- Strictly Necessary Cookies: Required for functions you request and essential security. Consent is not required where a statutory exemption applies; any related personal data processing must still have an applicable lawful basis. You can block these cookies in your browser, but essential functions may then be unavailable.
- Analytics/Performance Cookies: Help us understand visitor behavior. Legal basis: Consent (where required).
- Functional Cookies: Remember your preferences and settings. Legal basis: Consent.
- Targeting/Marketing Cookies: Where enabled, used to measure advertising or personalise marketing. These are used only after the required consent. Accepting website terms, remaining in a chat or consenting to chat processing does not amount to cookie consent.
- You can manage your cookie preferences through our cookie banner or your browser settings. Disabling certain cookies may affect website functionality.
- For more details, please see our Cookie Policy.

5. WHEN WE SHARE YOUR DATA

We do not sell your personal data to third parties.
We may share your data with the following categories of recipients for legitimate business purposes:
- Service Providers: Hosting and storage providers, analytics services, CRM and project-management systems, email platforms, approved connectors, commercial AI providers and meeting assistants providing transcription and note-taking services, IT support and cybersecurity services. Providers processing personal data on our behalf are subject to appropriate data-processing, confidentiality and security obligations. Any limited independent processing for account administration, legal compliance or security is assessed separately; broader independent use requires its own lawful justification.
- Affiliates: Other companies within our corporate group, where necessary for internal administration and efficient service delivery, subject to this Notice or equivalent safeguards.
- Professional Advisers: Legal counsel, auditors, accountants, and similar professional advisors bound by confidentiality obligations.
- Corporate Transactions: Potential buyers, investors, or advisors in connection with a merger, acquisition, or other corporate restructuring.
- Public Authorities: Regulators, courts, law enforcement, or tax authorities where we are legally required to disclose data, or where necessary to protect our rights, property, or safety, or the rights of others.
- Providers of Telegram, Slack, email and other messaging services, collaboration platforms and connected systems separately process information under their own terms and privacy policies, as applicable. Records retained by Allformance are separate from records held in the originating service. Deleting or editing a message or other record in that service does not necessarily remove an existing copy or an earlier version from our archive; you can contact
[email protected] to exercise your rights regarding our copy. Archiving does not remove or limit those rights.

6. INTERNATIONAL TRANSFERS

Your personal data may be transferred to and processed in countries outside your jurisdiction, including outside the EU/EEA, the UK, and the UAE. These countries may have different data protection laws.

For the business communication workflow, processing may occur in the UAE and in the countries used by our approved hosting, integration, meeting-assistant and AI providers, including the United States where relevant to the selected service. The actual locations depend on the product and regional configuration. We assess the applicable transfer requirements before enabling a provider or access from another country; details of recipients, locations and safeguards are available from [email protected].

Where required by applicable law (particularly the GDPR and UK GDPR), we implement appropriate safeguards to protect your data, such as:
- Adequacy decisions by relevant authorities (confirming the recipient country provides an adequate level of protection).
- Standard Contractual Clauses approved by the European Commission and, for restricted UK transfers, the UK International Data Transfer Agreement or the UK Addendum where applicable.
- Additional technical and organizational security measures where necessary.
- For transfers subject to UAE law, a permitted route under Articles 22 or 23 of the UAE Federal Personal Data Protection Law and any applicable implementing requirements. Contractual safeguards are supplemented by a transfer risk assessment and additional protections where the relevant law requires them.

You may contact us to obtain a copy of the safeguards in place or for more information about specific transfers.

7. HOW LONG WE KEEP YOUR DATA

We retain personal data only as long as necessary for the purposes outlined in this Notice, unless a longer retention period is required or permitted by law. Our retention periods are based on the following criteria:
- Active business relationships: Data needed for current relationship management is kept for that purpose; selected records may subsequently be retained for applicable legal obligations or reasonably anticipated claims. This does not mean that an entire chat archive is kept for the whole relationship plus every possible limitation period.
- Marketing data: Until you withdraw your consent or object, or for up to 3 years from your last interaction with us (whichever is shorter).
- Communication records (nonclient): Up to 6 years to comply with legal obligations and defend potential legal claims.
- Website logs: Up to 12 months (for security and analytics purposes), after which they are anonymized or deleted.
- Accounting/financial records: As required by applicable law (typically 5-10 years).
- Raw Telegram chat records: Normally no longer than 24 months from the date of each message, and less where the purpose ends earlier or a shorter contractual, platform or legal requirement applies. Attachments are not retained by this workflow. The period is a maximum operational limit, not a mandatory minimum. Selected records needed for a specific legal obligation or claim may be isolated and retained for the relevant obligation or claim period, with restricted access and no general AI reuse.

Meeting transcripts, notes and connector-sourced business records: Retained only for the period needed for the relevant service, relationship management or another documented lawful purpose, subject to applicable contractual and legal requirements. We configure provider retention and deletion controls accordingly. The absence of an audio recording does not mean that the transcript or notes are anonymous or may be retained indefinitely.
- Client summaries and derived records: Retained only while relevant to the client relationship or another documented lawful purpose. If they identify a natural person, they remain subject to the same necessity-based review and applicable rights; they do not acquire an indefinite retention period simply because they are summaries. Client-specific non-personal records remain subject to confidentiality and contractual retention requirements.
- Anonymous aggregated statistics: May be retained without a fixed personal-data retention period only for as long as they remain genuinely anonymous and continued use is permitted by the relevant client and platform terms. Reversible pseudonyms, recoverable extracts and identifiable outputs do not qualify. Retention and deletion rules cover source records, derived records, exported copies and backup expiry, as applicable.

When data is no longer needed, we securely delete or genuinely anonymise it. Backup copies are isolated from ordinary access and expire through a defined backup cycle; if a backup is restored, applicable deletions are re-applied. Backups are not used as a means of indefinite retention.

8. SECURITY

We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS/SSL) and at rest.
- Strict access controls and authentication requirements.
- Regular security assessments and monitoring.
- Staff training and confidentiality obligations.
- Incident response procedures.

For business communication archives and integrations we apply need-to-know access, separation between client records, access logging, approved corporate accounts and controls over exports and onward disclosures. Connector permissions are limited to approved business sources. Staff must not export private communications or upload client information to unapproved personal AI accounts or storage services.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. You are responsible for using secure devices, maintaining password confidentiality, and ensuring secure network connections when accessing our services.

9. CHILDREN

Our website and services are not directed at or intended for individuals under the age of 18. We do not knowingly collect personal data from children under 18.

If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected], and we will take steps to delete such information promptly.

10. YOUR RIGHTS

Depending on the laws applicable to the processing (including the GDPR, UK GDPR and UAE Federal Personal Data Protection Law where applicable), you may have the following rights regarding your personal data:
- Access: Obtain confirmation of processing and a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure ("Right to be Forgotten"): Request deletion of your data in certain circumstances.
- Restriction: Limit how we use your data in specific situations.
- Data Portability: Receive your data in a structured, commonly used, machinereadable format and transmit it to another controller.
- Objection: Object to processing based on our legitimate interests, including profiling.
- Marketing Objection: Object at any time to processing for direct marketing purposes.
- Withdraw Consent: Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before its withdrawal.

How to exercise your rights:
Contact us using the details in Section 1. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law (typically within one month, which may be extended for complex requests).

For requests concerning communication or meeting records, please identify the relevant channel or meeting, approximate dates and the data concerned without sending unnecessary sensitive information. Where we rely on consent, you may withdraw it through the available consent channel or by contacting us. Withdrawal does not affect prior lawful processing, and we explain any separate legal reason for retaining particular records. Objections to legitimate-interests processing are assessed under the applicable law.

Right to complain:
You have the right to lodge a complaint with a competent data protection supervisory authority under the applicable law. You may contact us first at [email protected], but doing so is not a condition for making a complaint.

11. CHANGES TO THIS NOTICE

We may update this Privacy Notice periodically to reflect changes in our practices, legal requirements, or business operations. The "Last updated" date at the top of this page indicates when the Notice was last revised.
For material changes affecting an existing processing activity, including a new purpose, connector, meeting assistant or AI-assisted use, we provide the required information before the change through an appropriate channel, such as email, an account-manager message or a notice in the relevant chat or meeting. We obtain fresh consent where required. Merely updating this webpage does not retrospectively authorise earlier processing.
We encourage you to review this Notice regularly to stay informed about how we protect your data.

12. CONTACT US